HHS Warns Health Care Sector About Zero-Day Cyberattacks

The Department of Health and Human Services has warned the health care sector about zero-day cyberattacks, which exploit system vulnerabilities that have not yet been discovered by the developer.

HHS said that zero-day attacks can endanger patients and their data, as well as force health care organizations to heavily invest in patching vulnerabilities, Fierce Healthcare reported.

One recent example of such an attack is the August 2021 exploitation of bugs collectively called “PwnedPiper” affecting pneumatic tube systems used by hospitals to transport medication, bloodwork and test samples.

The vulnerability allowed attackers to install unsigned firmware updates and access workstations without employee credentials.

HHS said the attack could have been prevented by network segmentation, an architectural approach to preventing an intruder from propagating exploits or laterally moving around an internal network.

The department said that zero-day attacks, by their nature, are impossible to completely mitigate. “Patch early, patch often, patch completely,” HHS said.

Organizations can also increase their chances by implementing firewalls or runtime application self-protection agents to detect anomalous behavior.

HHS reported an increase in the frequency of zero-day attacks caused by the wider commercialization of vulnerabilities.

Groups without the means to discover zero-day exploits on their own may now purchase them on the open market, HHS said. The department reported that the price of zero-day hacks rose as much as 1,150 percent between 2018 and 2021.

HHS quoted Jared Semrau, director of vulnerability and exploitation at FireEye Mandiant, as saying that one-third of the zero-day attacks that the company has discovered are financially motivated.